Splunk Search

Finding events that do not contain a specific string

teedilo
Path Finder

We have some issues with line breaking such that we have events that often consist of multiple logical events, or they might consist of fragments of logical records.  We've tried a variety of fixes but no joy so far.  Anyway, that's not really what my question is about.  I'm trying to do a Splunk search that finds only "good" events as in "Scenario 1" below, where the event begins with the XML tag <record> and ends with </record>.  There should be no other tags like this in the event, which would indicate an event like in "Scenario 2", which contains multiple logical events merged together.  

Scenario 1:

 

<record>
blah blah
blah
</record>

 

Scenario 2:

 

<record>blah blah
blah</record>
<record>
blah
blah blah</record>
<record>
blah
blah blah</record>

 

I learned that this can be accomplished outside of Splunk using a "negative lookbehind".  I tried this in a Splunk search like the one below.

| regex "(?s)^<record>((?!<record>)(\s|\S))*<\/record>$"

I couldn't get this to work, however.  This does work as expected in regex101:

Any ideas?  I used the regex command instead of the rex command because I didn't need to extract anything.  Thanks in advance.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Technically, you are using a negative lookahead not lookbehind, but it is what you want. Which version of splunk are you using as this works on 8.1.3 and 7.3.3

 

| makeresults 
| eval events=split("<record>
blah blah
blah
</record>|<record>blah blah
blah</record>
<record>
blah
blah blah</record>
<record>
blah
blah blah</record>","|")
| mvexpand events
| rename events as _raw
| regex "(?s)^<record>((?!<record>)(\s|\S))*<\/record>$"

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Technically, you are using a negative lookahead not lookbehind, but it is what you want. Which version of splunk are you using as this works on 8.1.3 and 7.3.3

 

| makeresults 
| eval events=split("<record>
blah blah
blah
</record>|<record>blah blah
blah</record>
<record>
blah
blah blah</record>
<record>
blah
blah blah</record>","|")
| mvexpand events
| rename events as _raw
| regex "(?s)^<record>((?!<record>)(\s|\S))*<\/record>$"

 

teedilo
Path Finder

Thanks for clarifying on the terminology.  I had copied the terminology from another posting so they must have misused it as well.  In any case, good to know it works in a newer version of Splunk.  I was afraid you'd ask which version of Splunk we're on because I'm embarrassed to say that we're still on 5.0.1.  We've had no end of difficulties upgrading and dealing with other problems in Splunk.  IMHO Splunk is a very difficult product to administer and we just don't have the time it apparently takes to do a good job with it.  Thanks for trying to help anyway.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...